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SUBJECT:  BIOMETRICS:  EU  TECHNICAL  STANDARDS  FOR  PASSPORTS 
AND  FINGERPRINTS 

REF:  (A)  STATE  23029  (B)  04  BRUSSELS  4844 

1.1 . (SBU)  Summary.  The  EU  is  set  to  approve  a decision  on 
technical  standards  related  to  biometrics  in  travel  documents 
by  the  end  of  February.  From  that  point,  EU  Member  States 
will  have  18  months  to  begin  issuing  passports  that  contain 
digitized  photographs  on  contactless  chips.  A separate 
decision  which  will  outline  the  technical  standards  for 
including  digitized  fingerprints  in  passports  is  still  under 
discussion.  The  European  Commission  (EC)  envisions  limiting 
access  to  the  digitized  fingerprints.  However,  agreements 
with  third  countries  may  be  permitted  so  that  foreign 
officials  can  verify  the  identity  of  the  passport  holder 
through  a fingerprint  comparison.  National  laws  will  govern 
the  usage  of  digitized  fingerprints  that  are  collected  as 
part  of  the  passport  application  but  kept  in  national 
databases . Some  Member  States  have  questioned  the  EC 
regulation  that  mandates  universal  collection  of  fingerprints 
from  passport  applicants,  noting  that  fingerprints  of 
children  under  age  seven  are  often  unverifiable  due  to  size. 

Although  the  European  Parliament  objected  to  including 
digitized  fingerprints  in  passports,  its  opinion  was  ignored 
by  the  EU  Council.  End  Summary. 


Technical  Standards 


12.  (SBU)  The  European  Commission  (EC)  has  finalized  its 
proposal  for  most  technical  standards  related  to  biometrics 
in  passports  and  has  gained  approval  from  the  Article  6 
committee.  Within  the  next  few  days,  the  official 
translations  of  this  decision  will  be  sent  to  national 
capitals,  and  final  approval  by  the  EU  Council  is  expected 
before  the  end  of  February.  The  decision  will  cover  the  EU's 
overall  approach  to  biometrics  in  passports,  as  well  as 
specific  standards  related  to  the  incorporation  of  digitized 
photographs.  Standards  such  as  the  scope  and  limitation  of 
biometrics,  storage  requirements  and  medium,  passport  and 
chip  layout,  data  security  issues  and  other  technical  details 
will  be  defined  in  the  decision. 

13.  (SBU)  Once  approved,  the  18-month  implementation  phase  for 
the  EU  Member  States  begins.  All  Member  States  will  need  to 
be  issuing  passports  that  comply  with  the  ICAO  standard  by 
the  end  of  August  2006  (a  date  which  would  meet  the  U.S. 
deadline  only  if  Congress  agrees  to  a second  one-year 
postponement).  Member  States  may,  however,  begin  issuing 
passports  as  soon  as  they  are  ready.  Belgium  is  already 
issuing  passports  with  biometrics,  and  the  EC  believes  that 
Germany  may  follow  shortly. 


Fingerprints  and  Access 


14.  (SBU)  The  EC  is  working  on  a separate  decision  that  will 

cover  technical  standards  related  specifically  to  passport 
fingerprints.  According  to  the  official  at  DG  Justice, 
Freedom  and  Security  (JFS)  drafting  the  decision,  the  EC  will 
require  only  two  fingerprints:  plain  impressions  of  the  left 

and  right  index  fingers  stored  on  the  chip  as  images.  Once 
this  regulation  is  adopted,  the  36-month  implementation 
period  to  add  digitized  fingerprints  to  national  passports 
begins . 

15.  (U)  The  use  of  digitized  fingerprints,  once  they  are 
incorporated  into  passports,  is  limited  by  Article  4.3  of  EC 
Regulation  2252  entitled  "standards  for  security  features  and 
biometrics  in  passports  and  travel  documents  issued  by  the 
Member  States."  The  regulation  states  that  the  biometric 
features  "shall  only  be  used  for  verifying:  a)  the 
authenticity  of  the  document  and  b)  the  identity  of  the 
holder  by  means  of  directly  available  comparable  features 
when  the  passport  or  other  travel  documents  are  required  to 
be  produced  by  law." 

16.  (SBU)  The  EC  regulation,  however,  does  not  govern  the  use 
of  the  fingerprints  collected  by  Member  States  during  the 
passport  issuance  procedure.  Member  States  may  decide  to 


retain  these  fingerprints  in  national  databases.  National 
laws  will  govern  whether  collected  fingerprints  can  be  run 
against  national  criminal  databases  as  part  of  the  passport 
issuance  process,  or  subsequently  used  for  law  enforcement  or 
other  purposes  (e.g.,  identifying  victims  of  the  tsunami). 

The  EC  is  not  aware  of  any  Member  State  currently  collecting 
fingerprints  as  part  of  the  passport  application  process. 

Some  Member  States,  however,  do  collect  fingerprints  for 
national  identity  cards,  which  are  in  turn  used  as  primary 
documents  for  passport  issuances. 

1.7 . (SBU)  The  EC,s  passport  fingerprint  regulation  will  also 
cover  the  issue  of  access.  According  to  the  drafting 
official  at  JFS,  the  EC  will  probably  opt  for  "extended 
access  control"  for  the  part  of  the  passport  contactless  chip 
that  contains  the  fingerprints.  Unlike  the  biographic  data 
and  digitized  photograph,  which  will  be  protected  with  "basic 
access  control"  (i.e.,  once  the  passport  is  swiped  the  data 
flashes  up  on  the  screen),  the  fingerprints  will  require  an 
access  key.  The  key  on  the  chip  will  need  to  match  the  key 
that  is  programmed  into  the  passport  reader.  If  the  two  keys 
match,  the  fingerprint  data  will  also  appear  on  the  screen. 

1.8.  (SBU)  The  EC  decision  will  require  all  25  EU  Member  States 
to  give  each  other  access  keys  to  the  fingerprint  data  in  the 
passports.  The  regulation  might  also  allow  for  agreements 
with  third  countries.  This  would  enable  an  EU  Member  State 

to  give  the  U.S.  or  other  third  country  the  access  key  for 
their  national  passports  and  allow  extended  access  to  the 
fingerprints.  There  has  been  no  discussion  yet  about  whether 
such  access  would  need  to  be  reciprocal.  Presumably,  third 
countries  would  be  limited  to  use  this  access  only  for  the 
purposes  described  in  paragraph  5 . 


Biometrics  and  Children 


19.  (SBU)  Two  of  the  Member  States  that  are  furthest  along  in 
incorporating  biometrics  into  passports  have  raised  questions 
over  the  provision  in  Article  1 of  EC  regulation  2252  that 
requires  all  passports  to  contain  digitized  photographs  and 
fingerprints,  including  those  issued  to  children. 

110.  (SBU)  The  Netherlands  sent  the  EC  an  interim  report  based 
on  a pilot  project  undertaken  in  six  municipalities  which 
concludes  that  collecting  biometrics  from  children  under  age 
7 is  unfeasible.  Of  the  610  voluntary  participants  under  the 
age  of  16,  there  was  a verification  failure  rate  of  100 
percent  for  fingerprints  collected  from  children  ages  two  and 
under.  The  size  of  the  finger  (and  thus  the  print)  was  too 
small  for  identifying  features  to  be  selected  for  a proper 
comparison.  The  mobility  of  these  children  also  contributed 
to  collection  flaws.  The  study  also  said  that  the  facial 
images  collected  for  babies  resulted  in  verification  failure 
in  25  percent  of  the  cases.  For  children  ages  3-6, 
fingerprints  were  unusable  in  29  percent  of  the  cases  (both 
prints)  with  only  one  print  useable  in  and  an  additional  7 
percent  of  the  cases.  Photograph  verification  failed  in  11 
percent  of  the  cases  for  this  age  group.  Based  on  these 
results  and  the  fact  that  the  Netherlands  still  allows  for 
family  passports,  Dutch  authorities  have  suggested  that  the 
EC  amend  regulation  2252  to  exempt  children  from  the 
biometrics  requirement. 

1.11.  (SBU)  Germany  has  also  expressed  its  concern  to  the  EC 
about  biometrics  for  children.  According  to  the  EC,  Germany 
does  not  plan  to  incorporate  biometrics  into  its  special 
passports  for  children  that  are  issued  by  over  6000 
municipalities  across  the  country.  This  will  not  violated 
regulation  2252  since  Article  1.3  exempts  the  biometric 
requirement  for  passports  having  a validity  of  12  months  or 
less,  an  exemption  which  covers  the  German  child  passport. 


Parliament, s Opinion  and  Future  Role 


112.  (U)  On  December  1,  the  European  Parliament  passed  a 
non-binding  resolution  (471  votes  for,  118  against,  and  6 
abstentions)  regarding  the  EC,s  proposal  on  biometrics  in 
passports.  MEPs  agreed  on  the  inclusion  of  digitized 
photographs,  but  insisted  that  digital  fingerprints  remain 
optional  for  the  Member  States.  They  also  opposed  the 
establishment  of  a central  database  for  EU  passport 
information,  alleging  potential  risks  to  abuse  of  the  data 
and  mission  creep.  MEPs  stated  that  biometrics  should  only 
be  used  to  match  the  traveler  with  the  document  and  should 
not  be  used  for  background  checks.  Furthermore,  MEPs  called 
for  the  regulation  to  come  into  effect  only  if  and  when  the 
national  data  protection  authorities  were  given  adequate 
investigative  powers  and  resources  to  ensure  data  protection. 

113.  (U)  Because  of  the  EC  governmental  structure  in  place  in 
2004,  the  Council  was  able  to  ignore  many  of  the 
Parliament, s concerns  when  it  adopted  Regulation  2252  on 


December  13. 


114.  (U)  However,  on  December  15,  the  Council  adopted  a 
decision  which  substantially  strengthens  the  Parliament, s 
role  in  most  decisions  related  to  border  management.  As  of 
January  1,  the  Parliament, s role  has  been  elevated  to  a 
"co-decision  making"  procedure.  The  December  13  decision 
also  modifies  the  procedure  within  the  Council  on  all  border 
matters  except  legal  immigration  from  unanimity  to  "qualified 
majority  voting".  (Note:  The  UK,  Ireland  and  Denmark  will 
not  be  affected  by  many  of  these  decisions  because  of  their 
negotiated  opt-outs.  End  Note.) 


Comment 


.115.  (SBU)  While  the  procedural  changes  should  speed  up  the 
decision-making  process  on  the  Council  side  of  the  house,  the 
Parliament, s role  will  likely  prove  a brake  on  key  USG  goals 
such  as  information  sharing  and  other  measures  to  enhance 
international  transportation  security.  Issues  that  the 
Parliament  holds  dear,  like  data  protection  and  privacy,  will 
need  to  be  addressed  more  robustly  before  the  EC,s  proposals 
can  be  adopted. 

116.  (SBU)  The  EC  has  not  applauded  Belgium  for  its  early  lead 
in  rolling  out  a biometric  passport,  particularly  since  it 
did  not  wait  for  the  technical  standards  decision  to  be 
finalized.  One  of  the  primary  motives  for  the  EC  to  exert 
competence  in  the  passport  process  was  to  play  a coordinating 
role  and  ensure  interoperability.  The  EC  notes  that  without 
the  readers  and  other  necessary  infrastructure  in  place,  the 
Belgian  biometric  passports  are  virtually  meaningless; 
currently,  they  cannot  even  be  read  at  the  Brussels  airport. 
Nevertheless,  the  EC  understands  Belgium, s particular 
interest  in  spearheading  the  move  to  more  secure  passports 
because  of  its  probationary  status  in  the  visa  waiver  program. 


MCKINLEY 


